Crypto Fraud / Class Action Investigation

The Qbit $28M Pig Butchering Machine

EvilCorporations.com • Case 5:25-cv-02565, U.S. District Court N.D. California • 61 min read

A Silicon Valley fintech company and its CEO allegedly ran a crypto laundering operation that processed stolen funds from thousands of victims. One man lost $90,000. A federal class action says he was just one node in a $28 million crime network.

What They Actually Stole From You

Michael Mashkevich lives in Albertville, Alabama. He’s not a Wall Street trader. He’s not a crypto day-trader with a portfolio manager on speed dial. He’s a regular person who got a WhatsApp message in late March 2024 about a part-time online job. The message looked harmless. So he replied.

What followed was four weeks of psychological demolition dressed up as employment. The people on the other end of that phone — using names like Lee, Ava, and Miller — were not people trying to help him earn money. They were running a script. Every encouraging message, every “you’re doing great,” every fake withdrawal that showed real money landing in his account, was a calculated step in a process designed by criminal organizations to maximize how much they could extract before he figured out what was happening.

He watched his account balance grow. He made real deposits of real money from his real bank-linked accounts at Coinbase and Kraken. He was allowed to withdraw small amounts — enough to confirm the whole thing felt legitimate. Then the traps arrived. His account balance went negative because of “combination tasks.” His “credit score” on the platform dropped to 80%, and he was told he needed to pay $1,000 per point to restore it, or wait ten months. The people coaching him generously offered to “help.” On April 17, he was told he owed taxes on his commissions before he could touch them. On April 19, he was told the FBI was investigating — and that Lee had accidentally transferred him stolen money borrowed from a friend, which made everything Mashkevich’s problem now.

By the time it was over, he had transferred approximately $90,000. Not $90,000 of investment capital. $90,000 of life savings. Gone into a chain of cryptocurrency wallets designed specifically to disappear money so completely that the only way to trace it is with a professional blockchain forensics firm and a court order.

The money did not vanish into thin air. According to investigators, it traveled through thirteen “pivot” wallets, was converted from Ethereum to USDT on the Tron blockchain, passed through multiple staggering and commingling operations designed to erase its trail, and ended up — at minimum — in a wallet registered to a company with a Silicon Valley address, a LinkedIn page, and a CEO who spoke at a ZhenFund startup event and called himself a legitimate banker.

Mashkevich is one of thousands. The complaint estimates the operation ran from March through at least June 2024 and processed $28 million across what investigators say are at least 175 documented deposit wallets and thousands of victims. Each of those victims had their own version of this story. Each of them was told they were earning. Each of them was slowly walked to the edge and pushed off.

And then there is the second layer of victimhood that most news coverage ignores entirely. The people who sent those WhatsApp messages — the ones using names like Lee and Ava and Miller — were themselves in many cases enslaved. A Vietnamese teenager named Nguyen Thien Kai was promised a teaching job in Cambodia. She crossed the border and was sent into a basement to run scam scripts. When she used a hidden phone to text her family, her boss read the messages, beat her, and sold her to another criminal organization. Former prosecutor Erin West, who has spent years investigating these compounds, testified that 7 out of 10 women leaving these facilities reported being sexually assaulted. The United States Institute of Peace estimates 300,000 people are currently held against their will in these operations. They are guarded by men with AK-47s.

The corporate defendants in this lawsuit did not run the scam compounds in Myanmar. They are not accused of trafficking anyone. What they are accused of is providing the financial plumbing — the last mile of a money pipeline that runs from an enslaved teenager in a basement in Cambodia, through the savings accounts of thousands of ordinary Americans, into a stablecoin wallet operated by a company with a San Jose, California address and a press kit about “global payment processing.”

That is what was stolen. The money is the easy part to count.

The Three-Layer Theft Machine: How $28 Million Disappeared

Pig butchering is not a spontaneous crime. It is an industrial process. The complaint maps every stage with forensic precision, and the picture that emerges is not a bunch of hackers working from a parking lot. It is a structured financial operation with dedicated infrastructure for acquisition, laundering, and exit.

Layer 1: The Con

• Scammers using WhatsApp aliases (Ava, Miller, Lee in this case) made initial contact via mass message campaigns about jobs or investment opportunities tied to real, recognizable companies like Grayphite and Resy. Victims responded because the names were real and the offers were plausible.
• Victims were “trained” on fake online platforms that mimicked legitimate work or trading interfaces. Simulated data, fake balances, and staged withdrawals created the illusion of real earnings.
• Early withdrawals were permitted — a deliberate tactic. The target gets to see money leave the fake platform and land in their real account. This is the proof of concept that convinces them to deposit more.
• Escalation was engineered through manufactured crises: combination tasks that drove account balances negative, “credit score” systems requiring cash payments to reset, tax bills on phantom commissions, and threats involving law enforcement. Every crisis was a funnel directing the victim toward a larger deposit.
• The playbook was standardized. The complaint establishes that these tactics were consistent across all Class Members, not improvised per victim. This was a franchise operation, not individual con artistry.

Layer 2: The Laundering Network

• Victims deposited funds into one of at least 175 documented “Deposit Wallets.” These are the entry points of the laundering network, the first node where victim funds entered the system.
• From the Deposit Wallets, funds were routed to thirteen “Pivot Wallets” — aggregation points where money from multiple victims was pooled together. Commingling money from different sources is a core laundering technique because it makes tracing individual victim funds significantly harder.
• From the Pivot Wallets, funds on the Ethereum blockchain were sent to the OKX Web3 DEX Router where ETH was converted to USDT stablecoin, then transferred to the Tron blockchain via a SWFT Bridge. Blockchain hopping of this kind is a standard “exchange hopping” technique designed to break the investigative trail.
• On the Tron blockchain, funds passed through multiple “Culminating Points” where they were staggered (broken into smaller amounts) and commingled again before being consolidated at a wallet Qbit’s own lawyers described in a November 2024 letter as the “Master Cregis Account” — a wallet Qbit admits it owns.
• The Cregis Master Wallet received over $600 million USDT from a cluster of approximately 350 wallet addresses. Every wallet that sent more than $1 million USDT to the Cregis Master Wallet received transaction fee payments from a single address independently tagged by blockchain intelligence firm Chainalysis as a scam wallet.
• From the Cregis Master Wallet, at least $1,092,200 in traceable class member funds were sent to Qbit’s THGTen Destination Wallet at OKX. This is the wallet Qbit fought in court to unfreeze.

Layer 3: The Exit

• The Destination Wallets at OKX and other exchanges are the “off-ramp.” Once funds arrive here, the operator can convert cryptocurrency to fiat currency (regular dollars, yuan, etc.) and withdraw it entirely off the blockchain, where it becomes permanently unrecoverable by victims.
• The THGTen wallet received $251 million in USDT between March 5 and June 6, 2024 — a three-month window. Qbit transferred all but $7 million out of it, draining 97% of the wallet, while averaging only 1.66 outgoing transactions per day. Investigators note this transaction volume is inconsistent with any legitimate payment processing business.
• The $25 million in additional Class losses originated on the Polygon blockchain, traveled a parallel but analogous path, and also fed into the same Tron-based laundering infrastructure. An additional estimated $1.5 million from Polygon-chain victims is traceable to Culminating Point 1 on the Tron path toward Qbit’s wallet.

What They Said Under Oath (And What It Proves)

These are direct quotes from court filings. No paraphrasing. No editorializing. The documents speak for themselves — and they are damning.

Receipt 1: The U.S. Attorney’s Forfeiture Complaint on Bytechip

“Based on my training and experience, I know . . . Bytechip[‘s] Solidfi vAccount **1162 [is] used to provide money laundering infrastructure to a large wire fraud scheme perpetrated against numerous individuals. Bytechip LLC, Gatcha Pictures, and Paralel Design are entities interconnected through IP addresses, outgoing debit transfers, and intrabank transfers of funds, each performing an important function in a large fraud conspiracy ring. None of these entities bears any indicia of legitimacy in its operations. . . . I have demonstrated that wire fraud proceeds from pig butchering victims are frozen in . . . Bytechip Solidfi vAccount **1162, and that these accounts are used to launder the proceeds of wire fraud.”

• This is the sworn statement of U.S. Attorney Ritz in the federal forfeiture complaint filed January 22, 2024 — over a year before the current class action. The government did not suspect Bytechip of wrongdoing; it concluded that Bytechip’s accounts showed “no indicia of legitimacy” and contained confirmed pig butchering proceeds.
• The forfeiture was not contested to conclusion. Bytechip settled, forfeiting $542,728.30 from its own Solidfi account and waiving all rights to an additional $672,493.69 in a related account — for a total of $1,215,221.99 — through a stipulated agreement signed August 1, 2024.
• Bytechip and Qbit share the same CEO, same California address, and the same corporate structure. The class action argues they are functionally the same entity operating under different names for jurisdictional and liability-shielding purposes.

Receipt 2: Qbit CEO Yujun Wu’s Declaration to the Alabama Court

“The $7 million in the THGTen Destination Wallet was all deposited by Interlace account holders that have been screened through Interlace’s quality assurance procedures.”

• Wu submitted this statement to argue the frozen funds were legitimate. Interlace is presented as an independent third-party financial platform whose vetting procedures establish that Qbit’s customers are clean. The implication: if Interlace checked them, the money is above board.
• Wu did not disclose in this declaration that he is the CEO and founder of Interlace. According to his own LinkedIn profile, he has held that role since 2021. Interlace’s LinkedIn page lists Michael Wu as its CEO and founder. Wu is citing his own company as an independent character witness for his other company.
• The complaint further documents that Interlace (formerly iPeakoin) and Qbit share identical HTML source code warnings (both contain “We’re sorry but QbitPay doesn’t work properly without JavaScript enabled”), the same website analytics library (NPSMeter), and the same NPSMeter account identifier (9698c2ea853caafe). Their servers share IP address 47.89.250.82, which resolves domain names for qbitnetwork.com, ipeakoin.com, and interlace.money simultaneously.

Receipt 3: Qbit’s Claim of Financial Harm from the Injunction

“[T]he Qbit Wallet contains approximately $7 million worth of cryptocurrency” and “[b]ecause the Injunction Order froze the Qbit Wallet,” Qbit “must borrow money at high interest rates to pay back funds to its customers,” causing it to lose $6,000 each day.

• Qbit claims to be losing $6,000 every single day because of the wallet freeze. If true, that would mean Qbit waited 210 days — $1.26 million in self-described losses — before filing a motion to dissolve the injunction on January 20, 2025.
• The plaintiff’s legal team notes that Qbit provided zero documentation for this claim: no lender names, no loan amounts, no interest rates, no amortization schedules, no currency denominations, no dates. It is an assertion made in a sworn declaration with no documentary support of any kind.
• The class action argues this pattern — making conclusory claims without evidence while concealing material facts — is consistent with a company that cannot withstand scrutiny of its actual operations.

The Damage Beyond the Dollar Amount

Public Health

Financial fraud at this scale is a documented public health crisis. Pig butchering victims lose savings, not discretionary income. The mechanisms of this specific scam amplify the psychological damage beyond what conventional fraud inflicts.

• The scam is engineered to destroy trust in the victim’s own judgment. Victims are permitted to withdraw small amounts early in the scheme to confirm the platform is “real.” When the trap closes, the victim must reckon with the fact that they believed in something for weeks or months — and the psychological cost of that realization compounds the financial loss.
• The FBI reported 40,000 U.S. victims filed pig butchering reports in 2023 alone, representing an estimated 15–25% of actual victims. That implies a minimum of 160,000 U.S. victims in a single year, every one of them having experienced a prolonged, personalized psychological attack that culminated in total financial loss.
• Former prosecutor Erin West has documented that victims of pig butchering schemes frequently describe the experience in terms associated with intimate partner violence: betrayal by someone they trusted, shame at having been deceived, and difficulty explaining the harm to people who were not targeted because “why would you send them $90,000.”
• The human trafficking victims forced to operate these scam networks face documented physical and sexual violence. Of women leaving Southeast Asian scam compounds, NGOs on the ground reported 7 out of 10 disclosed sexual assault during captivity. This is a direct public health harm enabled by the financial infrastructure that processes and legitimizes the stolen proceeds.
• The U.S. Institute of Peace estimates 300,000 people are currently held in forced labor in scam operations globally. This is a sustained, large-scale atrocity that exists because the financial laundering infrastructure makes the operation profitable enough to justify the operational costs of enslaving a labor force.

Economic Inequality

Pig butchering operations specifically target people who are financially aspirational but not financially sophisticated — a demographic that spans income levels but skews toward people for whom the promised returns represent a genuine life-change, not a portfolio diversification.

• The complaint’s plaintiff is a resident of Albertville, Alabama. Median household income in Albertville is below the national median. A $90,000 loss is not a setback for a person in this economic position. It is a catastrophe that may eliminate retirement savings, emergency funds, or home equity accumulated over years.
• The FBI estimates pig butchering scams cost Americans $5.3 billion in 2023 alone. With only 15–25% of victims reporting, the actual annual toll is estimated at $20 billion. This wealth does not disappear; it is transferred. It leaves the domestic savings of working and middle-class Americans and flows into the accounts of international criminal syndicates and, according to this lawsuit, fintech companies operating out of San Jose with LinkedIn profiles and Hong Kong offices.
• The Class in this case is defined as all persons who transferred cryptocurrency into the documented Deposit Wallets, which number at least 175 addresses. The complaint estimates thousands of victims within the class period of March through June 2024 alone. This is a four-month extraction operation, not an isolated incident.
• Cryptocurrency is increasingly used by lower- and middle-income Americans as an investment vehicle precisely because it does not require the account minimums, advisor relationships, or institutional access of traditional markets. Pig butchering operations exploit this by targeting platforms and messaging specifically toward people using crypto as a path to financial mobility. The scam weaponizes financial aspiration.
• Recovery is structurally asymmetric. Large institutional investors who lose funds to fraud have legal teams, insurance products, and regulatory contacts. Individual victims must hire private blockchain forensics firms (like Inca Digital in this case), file emergency injunctions across multiple state jurisdictions, and then bring federal class actions just to establish the possibility of recovery — a process that costs far more than most victims lost individually, making individual suits economically irrational and forcing reliance on class action structures that may take years to resolve.
• Criminal operations behind these scams include the Chinese 14K Triad and entities connected to Myanmar’s Karen Border Guard Force (renamed Karen National Army in 2024). Myanmar is one of only three countries on the FATF global money laundering and terrorist financing blacklist, alongside North Korea and Iran. Money flowing through these networks directly finances armed militias and criminal syndicates that operate with geopolitical impunity.

What The Numbers Mean In Human Terms

Who To Watch. What To Do. How To Fight Back.

The injunction could be dissolved any day. Here is who is accountable, where to report, and what collective action looks like in a case like this.

The Named Defendants

• Yujun Wu (Michael Wu), CEO and sole owner of UAB Qbit Financial Service, sole member/CEO of Bytechip LLC, and undisclosed CEO/founder of Interlace. California resident. Mountain View, CA address on file with California Secretary of State as of July 24, 2024.
• UAB Qbit Financial Service, Lithuanian LLC Registration Code 305577101. U.S. office listed at Zanker Rd, Ste 110, San Jose, CA 95131. Offices also in Hangzhou, Shenzhen, and Hong Kong.
• Bytechip LLC, Delaware LLC No. 736317 / California File No. 202021210840. Registered address: 2381 Zanker Rd, Ste 110, San Jose, CA 95131. Previously subject to DOJ forfeiture action.
• WhatsApp aliases Olivia Ava, Emma Miller, and F.B. Lee — the front-line contact operators in this specific operation. Their real identities are unknown and subject to discovery.

Regulatory Watchlist

• FBI Internet Crime Complaint Center (IC3): The FBI tracks pig butchering specifically and reported 40,000 U.S. victims in 2023. File at ic3.gov. Every report adds to the evidentiary record that forces congressional and DOJ attention.
• U.S. Department of Justice — Money Laundering and Asset Recovery Section (MLARS): Already involved via the Bytechip forfeiture. The civil class action complaint asks the federal court to recognize and reinforce the Alabama injunction. MLARS handles the criminal side.
• Financial Crimes Enforcement Network (FinCEN): Banking-as-a-service operations like the one described in this case are subject to Bank Secrecy Act obligations. FinCEN is the agency that enforces AML compliance for financial intermediaries.
• U.S. Treasury / OFAC: Qbit’s THGTen wallet is within three transaction hops of two OFAC-sanctioned entities. OFAC has jurisdiction over entities that conduct transactions with sanctioned parties. The scam’s organizational backers include Wan Kuok-Koi (“Broken Tooth”), a sanctioned Chinese organized crime figure.
• Consumer Financial Protection Bureau (CFPB): If you used a U.S.-based exchange like Coinbase or Kraken to fund a pig butchering wallet and the exchange failed to detect or warn you about suspicious activity, CFPB takes complaints about financial service firms at consumerfinance.gov.
• Federal Trade Commission (FTC): The FTC tracks crypto fraud at reportfraud.ftc.gov. Aggregate complaints influence rulemaking and enforcement priority.
• OKX Exchange: As the exchange hosting the THGTen Destination Wallet, OKX is subject to the Alabama court injunction. If they release the frozen funds before the federal court acts, that becomes its own legal event. OKX’s compliance team can be contacted directly; document everything.

Mutual Aid and Grassroots Resistance

• If you or someone you know was victimized by a pig butchering scheme, contact the attorneys of record immediately: Vijay J. Rajagopal at Kurichety Law PC (vijay@kurichetylaw.com) and Michael Kozlowski at Esbrook PC (michael.kozlowski@esbrook.com). The class action is open to any person who transferred cryptocurrency to any of the 175+ Deposit Wallets listed in Appendix A of the complaint.
• The Global Anti-Scam Organization (GASO) at globalantiscam.org provides peer support, documentation tools, and reporting guidance for pig butchering victims. Their database of scam wallet addresses is a community-maintained intelligence resource.
• Former prosecutor Erin West’s Project Karma initiative coordinates law enforcement, NGOs, and victim advocates specifically on pig butchering. Following her work and amplifying it to people in positions of legislative and media power is direct action — this crime remains dramatically underreported and underfunded for investigation relative to its scale.
• If you have received unsolicited cryptocurrency investment messages on WhatsApp, Telegram, or dating apps, report the sending phone number and account to the platform and to the FBI’s IC3 immediately. Do not engage, even to investigate. These operations are documented and professional; engagement is the first step in the playbook.
• Contact your U.S. Senators and Representative and ask them directly: what is Congress doing to hold U.S.-adjacent fintech companies accountable for providing laundering infrastructure to international pig butchering networks? This case is filed in a federal court in California. It has named defendants with California addresses. This is not a distant foreign crime.
• Share this case. The FBI estimates only 15–25% of victims report. The primary reason victims do not report is shame. The normalized framing of “you should have known better” is itself a product of these operations — the scam compounds have message-tested it. Changing the public narrative is part of the accountability infrastructure.